Claude Code can now download files with two new tools, FetchAttachment and DownloadTaskFile. Self-hosted runners get --hold-idle-file and --max-hold-min, which keep a session held while a file you update stays recent. Apps that embed Claude Code can pass a separate sign-in token for cloud sessions with CLAUDE_CODE_SESSIONS_OAUTH_TOKEN. Organizations can now list fingerprints of approved plugin releases in managed settings. A hooks plugin then loads only from a folder that matches one of them. Setting CLAUDE_CODE_PLAIN_DELTA_FAST_PATH turns on a quicker way to pass along plain streamed text when Claude Code runs without its interactive screen.
Some work in this build is not switched on yet. A built-in plugin that connects Claude to the Claude Platform developer docs is bundled but stays off. Background memory extraction can be made to run as a task you can stop, but this is off by default. Claude Code can also combine held-back pieces of a streamed reply into one update, and that is off unless switched on remotely. Several new server-controlled switches appear too, and what they control is not known.
Agent worktrees are no longer removed while another task is still working inside them. Attachments too big to hold in memory are now saved to the uploads folder instead of being rejected. Large images also get a smaller copy for Claude. Interrupting Claude Code while it reads an MCP resource or folder now cancels the read cleanly. Text with wide characters no longer overflows the terminal, because Claude Code now re-wraps such lines character by character. These are part of the fixes, and the full list is below.
Written by our agent from the shipped bundle, not by Anthropic.
Claude Code recognizes a --personal flag, and session start-up and cloud session creation gain persistentVolumeFromSessionId
InterfaceA new CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS variable appears, and some permission rules are now marked as not waivable in bypass mode
Remote sessions gain handlers that place downloaded files in a session folder, and plugins can paint text and decorations into the prompt box
ExtensionsNew environment variable CLAUDE_CODE_PLAIN_DELTA_FAST_PATH turns on a shortcut for streamed output in headless sessions
Managed settings can list pluginDigests on a marketplace, so plugins in prependPlugins or appendPlugins run at the organization tier
mcpMount settings layer and remembered security warningsSettings & configWant the reasoning? Read walks the 50 entries that probably matter to you, each one opening to what changed and why.
Read this release → Every row →16 more of these are in What probably matters to you, on page 1.
Claude Code's bash reader now treats more ambiguous array and bracket forms as unclear, so some commands may ask for permission
On Windows, the hint for missing sandbox dependencies can now suggest /sandbox install and link to the sandboxing documentation
A feedback dialog now accepts an empty answer or a single digit: 0 or 1 for errors, 0, 1 or 2 otherwise
When a file attachment is refused because of its path, Claude Code now picks between two error messages based on the path
The shell command reader gains a new check that can mark some commands unreadable, which may mean more permission prompts
Unclear Which shell commands this new check affects is not clear.
When logging in with a pasted code fails in a particular way, Claude Code now shows a dedicated error
-- in gcloud compute ssh#Claude Code now flags a gcloud compute ssh command with a short option other than -q or -h placed before --
Unclear Whether a flagged command asks for permission or is blocked outright is not clear.
Cloud session uploads now pause with growing waits after repeated route failures, or at once on a 405 or 501 response
-F can now count as safe without a prompt#Claude Code's list of safe ruby flags now accepts any argument beginning with -F
The confirmation before deleting items now says they are deleted from this computer and that this can't be undone
Before a shell command runs, Claude Code now checks more of its redirects to files and can refuse it or ask you first
Unclear Which redirect targets the new pass covers is not known.
When the native updater is refused a registry session, it now reports that specifically instead of a generic install failure
If browser sign-in is refused, Claude Code now shows the refusal message, not a generic failure
Claude Code can now pick out leading VAR=value assignments and the command words that follow them in shell commands
Unclear Whether this changes which Bash commands are allowed or denied is not stated.
In the background tasks list, entries that cannot be opened now show 'cannot be opened' next to them
The notices about this machine's MCP servers not being shared with cloud sessions are reworded to say you can allow it
Claude Code now treats another kind of misread shell command, involving $ values, as unreadable instead of trusting its reading
Claude Code now stops sending usage data to Datadog once network rules refuse that traffic
A subagent's result may now begin with a note about the tools it used before it is passed back to the main conversation
Unclear What the note says and when it is switched on are not known.
A clearer token error for remote control, extra startup measurements, and permission prompts that can show a note from the tool
rm targets#Claude Code's shell checks now analyse for and while loop headers, reject some declarations, and parse rm targets two ways
Failed remote upload messages no longer warn against sending files as base64, and the SHA-256 checksum message is reworded
The sign-in line in an MCP server's details now shows a dimmed "not signed in" in one case instead of "not authenticated"
Unclear When "not signed in" appears instead of "not authenticated" is not known.
If a pasted sign-in code is not accepted, Claude Code now says why it might have failed and asks you to sign in again
When a session resumes a turn that ended in a server error, a prompt from you now takes priority, not only after rate limits
Unclear Which server errors count for this is not known.
When an MCP tool's structured result cannot be read, Claude is told why and warned the tool may already have run
The confirmation for deleting items across all projects now says they are deleted from this computer and this can't be undone
When an MCP task's status answer is too large to read, the task now fails with a message warning the tool may have run
Claude Code adds an error for a subscription blocked by a past-due payment and a hint to restart a process that stopped responding
When you press Esc to cancel, Claude Code now tells linked apps who stopped the turn, whether another follows, and what was cut off
do not after ; or a new line can no longer be checked as safe#Claude Code now refuses to verify loops, functions and coproc commands whose do is not preceded by ; or a line break
When a command writes to several files, Claude Code now checks every target and asks about one needing a safety check first
Unclear Whether redirects to /dev/null still go through without a prompt is not shown.
If the runtime has no built-in root certificates, Claude Code now allowlists no root certificate authority and says why
When the prompt box has text, the footer now says to clear it to open review or dismiss, instead of showing the shortcuts
/review help text now says the effort level goes before the target#The /review description now states that the effort level must come first, before any target such as a PR number or path
After listing what it will remove, purge now says it deletes data only on this computer, not anything Anthropic stores
The dialog for choosing an IDE is now titled "Select IDE to set up Claude Code" instead of "Select IDE to install extension"
In a searchable list, Ctrl-D now exits when the search box is empty, or closes the debug view if that is open
Unclear It is not clear which screen this searchable list is.
00<file redirects like 0<file#Claude Code now treats input redirects written with several zeros, such as 00<file, the same as 0<file when checking for read-only commands
The pop-up about usage credits added to your account now reads Expires in 90 days, with a capital E
Diffs shown in tool results now use a different comparison method when whitespace is not ignored, which may group changes differently
If a reactive compaction reply has no summary, Claude Code asks once more and fails only if the second reply has none either
Unclear It is not clear whether this second request is switched on.
When an agent's worktree is cleaned up, Claude Code now keeps it if another running or parked task is still working inside it
Attachments too big to hold in memory are now written to the uploads folder rather than rejected, and large images get a smaller copy for Claude
Unclear This new download handling sits behind conditions that were not identified, so it is unclear whether it is active for you.
When creating a cloud session is refused as unauthorised, Claude Code can refresh its sign-in token and try once more
! patterns in ignore files now bring files back into file suggestions#A ! pattern in an ignore file now re-includes matching files in @ file suggestions instead of being treated as a plain ignore
Interrupting a remote session now chooses between two credential sources and sends the request through a retry helper
The freeze detector now allows for the system's timer slack, so small delays it causes are no longer reported as freezes
Remote transcript uploads are now awaited only until upload finishes or Claude Code shuts down, and writes are kept in the order they were made
If a server replies to a rate-limit or overload error with x-should-retry: false, Claude Code now stops instead of retrying
Unclear Exactly which 503 responses honour the header is not stated.
When forced wrapping still leaves lines too wide, Claude Code now re-wraps them character by character
The automatic opening of the /diff pane now waits for fresh changes and backs off if you toggled it, it is open, or there is nothing to show
Claude Code now saves which MCP servers you switched off in a session and switches them off again when a remote worker resumes it
Unclear It is not known what condition decides whether this saving and restoring happens for you.
After a request is refused as unauthorised, Claude Code refreshes credentials and retries, then makes a quiet second refresh if the retry fails
Interrupting Claude Code while it reads an MCP resource or folder now cancels the read cleanly instead of reporting a misleading error
When Claude Code checks a ruby command for permission, it no longer treats -F as an option that takes a value
Unclear It is not stated whether this makes ruby commands using -F more or less likely to need your approval.
When fetching the list of environments, each retry now uses freshly supplied login details instead of the ones built at the start
When memory extraction is cut short, Claude Code no longer records an error and reports the outcome as unfinished, not failed
In cloud sessions, temporary status rows shown during a turn can now be withdrawn once a tool result arrives
Unclear How this changes what a viewer actually sees is not stated.
When a teammate shuts down, its tasks are now unassigned from the session's configured task list rather than always the team's default list
When a remote control connection recovers, Claude Code now refreshes a stale login and retries even if the new token matches the old one
claude respawn reports a bad job name before checking the background service#A wrong or ambiguous job prefix given to claude respawn is now reported even when the background service is down
When an MCP server error already starts with the server's name, Claude Code no longer adds the name again
Pressing Escape while editing a text field now puts back the original value, and the field can refuse the cancel
Formatted text now treats a backslash before a closing quote or bracket as an escape, fixing how such text displays
Requests to Anthropic may carry an x-claude-code-sandy-plover header listing the tools used, and gzip now covers non-string request bodies
A new memory-extraction option, off by default, makes the background memory run register as a task that can be stopped
Claude Code can now combine held-back pieces of a streamed reply into one update, but this is off unless switched on remotely
New remotely controlled switches were added with no visible purpose, and two of them fall back to off
Unclear What any of these switches control is not stated.
Claude Code now reads three new switches that can be set from Anthropic's servers; what they control is not known
Claude Code's file and image download step now reads a server-controlled setting with on, count and off modes, which falls back to off
Unclear It is not known what the on and count modes change about downloads, or whether you would notice them.
Gates tengu_tingly_pearl, tengu_foamy_heron, tengu_vast_puddle and new tengu_snappy_tower move into one helper, with tengu_nested_ripple alongside
Unclear It is not known which feature this switch controls.
A new check tied to a server-controlled switch passes by default; what it guards is not yet clear
Unclear What feature this check guards is not known.
Claude Code has a new remotely controlled switch that stays off unless the server turns it on; what it controls is not known
Unclear It is not known which feature this switch controls.
Internal developer tooling that opens a tmux layout was restructured and still cannot run in the public build
6 more of these are in What probably matters to you, on page 1.
A handed-off turn can name a rewind_conversation request with requires_rewind_request_id and is refused unless that rewind came last
A new api_incremental_request_body mode lets gzip-compressed API requests reuse parts of earlier request bodies
Two remote settings can set the longest Bash timeout, in whole minutes from five minutes up, and Claude is told the limit
Unclear It is not clear what values the server sends, so the limit a session actually gets is unknown.
Setting CLAUDE_CODE_UNWATCHED_REPLY_HOLD_MS makes Claude Code batch streamed replies for subagents, side requests and compaction instead of handling each piece
Claude Code now uses the label Remote Control server mount when naming where a policy for a mounted MCP server came from
Claude Code now passes two new server-controlled switches to its VS Code extension, both treated as on when the server sends nothing
Unclear What either switch changes in the VS Code extension is not known.
Some sessions can now set how much tool output stays inline, cutting long output instead of saving it to disk
Unclear Which sessions supply this budget is not stated.
WebFetch now passes a word limit, set remotely and 0 when the server sends nothing, to the step that summarises a fetched page
Unclear It is not clear whether the fallback of 0 means no limit.
The server setting that turns on batched event uploads is now event_batch_upload, and the old joint_upload key no longer has any effect
Plugin entries now carry a marketplaceKind field from their source, and plugin attribution reads it alongside serverPluginId
Remote workers now number each event upload attempt, retry when auth headers are missing, and can wait briefly before writing start rows
Remote sessions get new keep-alive rules, a fixed event-hold policy in place of a server switch, and can start without their stored worker state
Print mode's internal reason labels changed, adding ones for a stop ending a moved shell and for an unattended start
Unclear It is not confirmed that print mode now ends background shells when stopped.
Messages marked turnCompanion are skipped when Claude Code places input attachments or looks up the first user message
A URL check now returns the address's protocol when an allow check passes, instead of rejecting anything that is not https up front
Unclear Which parts of Claude Code use this check, and so whether plain http addresses are now accepted anywhere, is not established.
When a background or retried request using your stored sign-in token is refused as unauthorized, Claude Code now makes a follow-up call about that token
A new converter turns ignore-file lines into search patterns, including rules starting with ! that re-include files
Unclear Which search feature uses this converter is not known, so it is unclear what it changes for you.
A message sent to a teammate is now created once, and the waiting copy and the transcript copy share the same ID
The check that decides whether a python or pypy command needs your permission now takes an additional input
Unclear What the extra input is, and whether it changes which Python commands run without asking, is not stated.
Claude Code reorganised how it handles the command.describe plugin event, with no visible change in behaviour
Claude Code now sorts the shell commands Claude runs into kinds such as running tests, building, linting and installing packages
Claude Code can record two more kinds of usage event and has a data format for describing a status, with nothing visible using them yet
Usage data gains fields on tools used, kinds of shell commands, reused request content and resuming agents in cloud sessions
Unclear What the new assigned-variable class changes about which commands need permission is not known.
Several new internal event and debug names appear, and one telemetry batching setting was renamed; none changes what you see on its own
Published verbatim by Anthropic for v2.1.311. Text is unmodified from the upstream changelog. Everything else on this page came out of the bundle instead, which is why the two lists don't match.
Of these 92 bullets, 18 name something an entry on this page also names, 22 name something no entry here does, and 52 name nothing specific enough to line up either way. The pairings are made on names both sides wrote down, a flag or a setting or a slash command, so read one as probably the same thing rather than as a fact, and read the middle number as candidates rather than as a miss count.
--hold-idle-file and --max-hold-min to self-hosted-runner, to keep an idle session while your host reports processes it left running
Probably self-hosted-runner-holds-idle-release-while-a-left-running-p, self-hosted-runner-logs-a-leftover-hold-line-in-its-watchdog, self-hosted-runner-can-hold-sessions-while-a-host-file-stays claude -p and SDK sessions saving transcript messages out of order or keeping messages that were taken back
No entry names this SubagentStop hooks running about twice a minute for each running subagent instead of once when it finishes
No entry names this .ignore/.rgignore negation rules that re-include git-ignored files
Nothing to match on claude mcp add, claude mcp remove and /mcp naming the current folder instead of the project entry in ~/.claude.json that holds a local-scope server when run below a repository root
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t claude mcp list and claude mcp get showing the error code twice on failed-connection lines (for example ENOENT: ENOENT: …)
No entry names this claude daemon restart; it now suggests claude daemon stop --any and says it ends background sessions
No entry names this claude respawn <id> starting the background service before reporting that no background session matches the id
No entry names this /effort not warning about a prompt cache miss in plan mode when the plan model differs from the session model
Probably effort-line-can-say-it-may-wait-for-your-next-message, effort-step-keybinding-with-cache-miss-confirmation, shiftupdown-bound-to-effort-increasedecrease-in-chat-keyb /ide saying the VS Code extension was installed before the install finished or when it failed
Probably ide-extension-install-flow-and-prompt-footer-spacing, ide-installs-the-extension-with-progress-ui agent; Cowork cloud sessions now ignore that setting
Nothing to match on --resume, --continue, /resume or --session-id, including after /clear or a crash, and /branch writing to the original session's list
Probably team-lead-process-recorded-clear-keeps-task-list-link, resume-restores-prompt-waits ! open /tmp/shot.png or /review look at /tmp/shot.png, attaching the image and dropping its path from the prompt
Probably review-ultra-help-text-clarified #101693Option to disable automatic conversion of image file paths into [Image #N] attachments in the prompt input Open
"\" or (\), disappearing from Claude's responses
No entry names this DISABLE_COMPACT is set
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp DISABLE_COMPACT is set
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp /code-review, or another skill that runs in a sub-agent, running a second time when a cloud or background session restarts
Probably review-ultra-help-text-clarified /ide saying it had installed the JetBrains plugin when nothing was installed
Probably ide-extension-install-flow-and-prompt-footer-spacing, ide-installs-the-extension-with-progress-ui /mcp showing a remote server as failed after "Clear authentication" when the server works without sign-in
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t /mcp showing "authenticated" for a remote server that Claude Code sends no credentials to
Probably mcp-clear-authentication-verifies-the-clear-and-reconnects, slack-mcp-server-gets-a-channel-posting-instruction, claude-api-skill-moved-into-a-plugin-gated-by-tengu-peppy-cr, new-bundled-plugin-cc-plugin-claude-platform-registered-in-t #98942[BUG] Claude Code marks an anonymous MCP server authenticated when it lists a tool Open
--plugin-dir folder of plugins loading as one plugin when an empty .mcp.json was at its top
Probably empty-mcpjson-is-skipped-claudemd-files-naming-devices-a /usage never showing large prompt-cache misses under "What's contributing to your limits usage?"
No entry names this CLAUDE_CODE_RETRY_WATCHDOG), indefinitely
No entry names this bwrap: Can't create file when a --plugin-dir folder was also an added directory and permissions.blockReadsOutsideWorkingDirectories was on
No entry names this /teleport and claude --teleport to warn when a compacted cloud session loads from its last compaction, so the messages it summarized aren't in the local copy
No entry names this #name and no longer says the address bar stays the same as you switch views
Nothing to match on claude --model opus
No entry names this ultrathink in the interactive terminal to run its turn at xhigh effort on Opus 5.5, Sonnet 5.5, Haiku 5.5 and Fable 5.1 through Anthropic's API; typed while Claude is working, it raises the rest of that turn
Nothing to match on ultrathink rainbow to appear only where the keyword can raise effort, and not when the word is quoted or part of a file path
Nothing to match on --output-format json and stream-json output to write DEL, C1 control and Unicode format characters inside strings as \uXXXX escapes; parsed values are unchanged
No entry names this [1m] suffix and its label on models where the suffix has no effect; the suffix is still accepted
Probably model-name-resolution-no-longer-special-cases-the-1m-suffix /code-review to tell Claude to put the effort level first and use max only when asked
Probably review-ultra-help-text-clarified DISABLE_COMPACT in settings files and in a mod's $.env.set so they can only turn compaction off, not back on
Probably disable-compact-env-var-now-treated-specially-by-the-setting, disable-compact-now-also-stops-teammate-in-process-auto-comp CLAUDE_CODE_SYNC_SKILLS with feature-flag fetching off to reuse a claude.ai skills list up to 10 minutes old that another session on the machine fetched
No entry names this claude purge to say it deletes data only on this computer, not anything stored by Anthropic
No entry names this DISABLE_TELEMETRY set while VS Code's telemetry setting is off, so they send no usage metrics or error reports and fetch no feature flags
No entry names this A model matched these bullets to the GitHub issues they fix, so a link can be wrong.
1 of 30 tool descriptions changed. The appended system-reminder blocks moved: 4 lines added, 5 lines removed.
Claude Code, interactive mode
12 prompt changes in this release could not be quoted from the build, so no entry on this page describes them.
437 documentation changes were recorded within 24 hours either side of this release, nearest first. The closest 12 are below. They're here because they happened near this release in time. That's not a claim that this release caused the edit, or that the page documents anything in it.
The 79 literal strings found in the bundle, with the number of entries that name each one. Picking one searches for it. A name is here because this build's code mentions it, which is not the same as it working or being finished.
What's wrong with this entry?